News for hackers. Stuff that matters.

A comment on Surveillance firm asks Mozilla to be included in Firefox's certificate whitelist.

Re:Surveillance firm asks Mozilla to be included in Firefox'... by dTal on Tuesday February 26, 2019 @01:47PM (#19257142)
The article presents this as some kind of difficult decision, but doesn't adequately explain why this should result in anything other than an answer of "no", with a side order of "hell no". Mozilla is under no obligation to add any particular organization to its list of trusted root CAs, and users rely on it for security. Some bizzare notion of "fairness" to a known bad actor doesn't seem like a remotely strong argument to me.

Play stupid games, win stupid prizes.

[ Parent | on HN ]
Re:Surveillance firm asks Mozilla to be included in Firefox'... by ncmncm on Tuesday February 26, 2019 @02:09PM (#19257337)
Yes, they should be troubled by whether they should even bother to explain why they have rejected it, and removed the QuoVadis authorities.

Agonizing over whether to let them in suggests they have let in other questionable entities. "Fairness" is a smokescreen. Nobody honest needs a certificate from a dodgy authority, and nobody with a certificate from a dodgy authority deserves benefit of doubt.

[ Parent | on HN ]
Re:Surveillance firm asks Mozilla to be included in Firefox'... by DyslexicAtheist on Thursday February 28, 2019 @11:02AM (#19272276)
it's a recipe for disaster :(

there are some standards which companies have to comply with in order to be considered a "trustworthy" provider (e.g. for CA's)

https://www.etsi.org/technologies/digital-signature/certific...

I doubt that DarkMatter has any of this (not that this would reduce the risk but it could be used as an argument by Mozilla considering they're stuck between a rock and a hard place.

[ Parent | on HN ]
Re:Surveillance firm asks Mozilla to be included in Firefox'... by uodtl on Tuesday February 26, 2019 @02:08PM (#19257319)
The rules are the rules. They want to follow the rules. If they don't follow the rules, they'll be making an exception. What's the point on having rules if you make exceptions?
[ Parent | on HN ]
Re:Surveillance firm asks Mozilla to be included in Firefox'... by vokep on Tuesday February 26, 2019 @03:14PM (#19257934)
Because most of the time the rules are in effect, except for the exceptions.

Rules exist for the purpose they serve, functions they allow to be easier and cheaper. Rules are not made so that rules have been made.

[ Parent | on HN ]
Re:Surveillance firm asks Mozilla to be included in Firefox'... by apostacy on Tuesday February 26, 2019 @04:28PM (#19258445)
While I agree with Mozilla's decision, the reason that there are rules is so that it isn't arbitrary. Who is to say who is trustworthy? What if Mozilla wants to charge a fee or else they will remove someone?

Those circumstances would easily fall under the purpose they serve.

[ Parent | on HN ]
Re:Surveillance firm asks Mozilla to be included in Firefox'... by ncmncm on Tuesday February 26, 2019 @02:11PM (#19257356)
Rules reduce expense, leaving resources to deal with exceptional cases. Applying rules to exceptional cases makes a mockery of both the rules and the organization applying them.
[ Parent | on HN ]
Re:Surveillance firm asks Mozilla to be included in Firefox'... by uodtl on Tuesday February 26, 2019 @02:19PM (#19257433)
Who's to say what an exceptional case is?
[ Parent | on HN ]
Re:Surveillance firm asks Mozilla to be included in Firefox'... by ncmncm on Tuesday February 26, 2019 @03:04PM (#19257855)
The facts of the case say, all by themselves.

It requires attention by the people applying the rules to recognize the facts, but paying attention is the reason to have people in the loop. Any machine can be corrupted.

[ Parent | on HN ]